Description
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."
References
- 32198 third-party-advisory
- http://drupal.org/node/318706
- [oss-security] 20081021 CVE req: drupal < 5.11/6.5 mailing-list
- drupal-uploadmodule-upload-security-bypass(45755) vdb-entry